2 cissp ® Official Study Guide Eighth Edition

Storing Sensitive Data
Sensitive data should be stored in such a way that it is protected against any type of loss. The 
obvious protection is encryption. AES 256 provides strong encryption and there are many 
applications available to encrypt data with AES 256. Additionally, many operating systems 
include built-in capabilities to encrypt data at both the file level and the disk level.
If sensitive data is stored on physical media such as portable disk drives or backup tapes, 
personnel should follow basic physical security practices to prevent losses due to theft. This 
includes storing these devices in locked safes or vaults and/or within a secure room that 
includes several additional physical security controls. For example, a server room includes 
physical security measures to prevent unauthorized access, so storing portable media within 
a locked cabinet in a server room would provide strong protection.

---

172
Chapter 5 
■
Protecting Security of Assets
Additionally, environmental controls should be used to protect the media. This includes 
temperature and humidity controls such as heating, ventilation, and air conditioning 
(HVAC) systems. 
Here’s a point that end users often forget: the value of any sensitive data is much greater 
than the value of the media holding the sensitive data. In other words, it’s cost effective to 
purchase high-quality media, especially if the data will be stored for a long time, such as on 
backup tapes. Similarly, the purchase of high-quality USB fl ash drives with built-in encryp-
tion is worth the cost. Some of these USB fl ash drives include biometric authentication 
mechanisms using fi ngerprints, which provide added protection. 
Encryption of sensitive data provides an additional layer of protection and 
should be considered for any data at rest. If data is encrypted, it becomes 
much more difficult for an attacker to access it, even if it is stolen.